T09 · Insecure Skill Coding Practices
- Location
SKILL.md:116- Finding
Predictable Temporary File Enables Symlink-Based File Overwrite
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 116-124
Vulnerability Type: Predictable temporary file and unsafe file creation
Risk Level: MediumVulnerable Code
bash source ~/.openclaw/config/minimax-api.env curl -s "https://example.com/image.jpg" -o /tmp/tmp_img.jpg curl -s "https://api.minimaxi.com/v1/coding_plan/vlm" \ -H "Authorization: Bearer $MINIMAX_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"prompt\":\"描述这张图片\",\"image_url\":\"data:image/jpeg;base64,$(base64 -w0 /tmp/tmp_img.jpg)\"}"Technical Analysis
The documented command stores downloaded content at the fixed, globally predictable path
/tmp/tmp_img.jpg. It does not create the file atomically, verify that the path is a regular file, restrict access to a private temporary directory, or remove the file after use.On systems where
/tmpis shared by multiple users or processes, an attacker can create/tmp/tmp_img.jpgbefore the command runs. In particular, the attacker may create a symbolic link at that path. Becausecurl -ofollows symbolic links when opening its output destination, the download can truncate and overwrite the symlink target with the privileges of the user running the Skill command.There is also a time-of-check/time-of-use exposure between the download and the subsequent
base64operation. Manipulation of the predictable path may cause content other than the intended image to be encoded and transmitted to the MiniMax API.Attack Path
- An attacker with local access predicts that the victim will use
/tmp/tmp_img.jpg. - Before the command runs, the attacker creates that path as a symbolic link to a file writable by the victim:
bash ln -s /home/victim/.config/example.conf /tmp/tmp_img.jpg - The victim executes the documented image-analysis command.
curlfollows the symbolic link and writes the downloaded image into the target file.- The ...[truncated 1040 chars]
- An attacker with local access predicts that the victim will use
- Remediation
View remediation
Remediation Suggestions
Replace the fixed path with a securely and atomically created temporary file. Quote all path expansions, fail on HTTP errors, restrict the file permissions, validate the downloaded object, and guarantee cleanup:
bash source ~/.openclaw/config/minimax-api.env umask 077 IMG_PATH="$(mktemp "${TMPDIR:-/tmp}/minimax-image.XXXXXX")" || exit 1 trap 'rm -f -- "$IMG_PATH"' EXIT HUP INT TERM curl --fail --silent --show-error \ --output "$IMG_PATH" \ -- "https://example.com/image.jpg" test -f "$IMG_PATH" && test ! -L "$IMG_PATH" || exit 1 IMAGE_DATA="$(base64 -w0 -- "$IMG_PATH")" || exit 1 curl --fail --silent --show-error \ "https://api.minimaxi.com/v1/coding_plan/vlm" \ -H "Authorization: Bearer $MINIMAX_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"prompt\":\"Describe this image\",\"image_url\":\"data:image/jpeg;base64,$IMAGE_DATA\"}"For stronger isolation, create a private temporary directory with
mktemp -d, store the image inside it, and remove the entire directory on exit. The instructions should also recommend validating the response content type and enforcing the documented maximum file size before transmitting the image.